Towards a flexible access control mechanism for e transactions
This presentation is the property of its rightful owner.
Sponsored Links
1 / 41

Towards a Flexible Access Control Mechanism for E-Transactions PowerPoint PPT Presentation


  • 50 Views
  • Uploaded on
  • Presentation posted in: General

The 2004 ACM/IEEE International Conference on E-Business and Telecommunication Networks (ICETE-04). Towards a Flexible Access Control Mechanism for E-Transactions. Vishwas Patil [email protected] http://www.tcs.tifr.res.in/~vishwas. R. K. Shyamasundar, Fellow IEEE [email protected]

Download Presentation

Towards a Flexible Access Control Mechanism for E-Transactions

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Towards a flexible access control mechanism for e transactions

The 2004 ACM/IEEE International Conference on E-Business and Telecommunication Networks (ICETE-04)

Towards a Flexible Access Control Mechanism for E-Transactions

Vishwas Patil

[email protected]

http://www.tcs.tifr.res.in/~vishwas

R. K. Shyamasundar, Fellow IEEE

[email protected]

http://www.tcs.tifr.res.in/~shyam

School of Technology and Computer Science

Tata Institute of Fundamental Research, Mumbai.


Outline

Outline

  • Need for Access Control

  • Present approaches: what more is required?

  • Background

  • Modeling security requirements for access control

  • Modeling dynamic security requirements

  • flexi-ACL

  • Conclusions

  • Future Directions


Need for access control

Need for Access Control

  • Irresistible advantages of using Internet

  • More and more resources are coming over Internet

  • Restrict the access to intended users

  • Access Control: distinguish between Authorized and un-Authorized users


Mechanisms simple complex

Mechanisms: Simple/Complex?

  • What is the nature of the security controls?

    • Do we require complexity or assurance?

  • Simple security mechanisms

    • easy to maintain

    • unlikely to be configured incorrectly

    • easy to prove implementation of security meets policy requirements

    • may not support all requirements of security policy

  • Complex security mechanisms

    • difficult to maintain

    • likely to be configured incorrectly

    • difficult to prove implementation of security meets policy requirements

    • support a wide variety of security features


Issues

Issues

  • Secure access

  • Protection against misuse of authorizations

  • Manageability

  • Fault-tolerance

  • On-line vs. Off-line trade-off

  • Emergency access measures

  • Granular access

  • Dynamic aspects in distributed environment

  • Sequential access: Layered security approach

  • Privacy issues

  • Trust management


Approaches

Approaches

  • Various proposals exist

    • MAC/DAC

    • PKI

    • PKI-based: PolicyMaker/KeyNote, RBAC et. al.

    • Capability-based

  • How to do it in abetter way?

    • flexi-ACL


Early days of access control

Early days of Access Control

  • Butler Lampson proposed “Access Control Matrix” (extended by HRU)


Access control matrix

Access Control Matrix

Reference

Monitor

Subject

Object

  • A request can be regarded as a triple (s, o, a)

    • s is a subject

    • o is an object

    • a is an access operation

  • A request is granted (by the reference monitor) if

    • a belongs to the access matrix entry corresponding to subject s and object o

Authorization

Database


Access control matrix1

Access Control Matrix

  • The matrix is likely to be extremely sparse and therefore implementation is inefficient

  • Management of the matrix is likely to be extremely difficult if there are 0000s of files and 00s of users (resulting in 000000s of matrix entries)

  • The administration of access control structures is extremely time-consuming, complicated and error-prone

  • Such kind of approach is suitable in OS, where the state transition is internal to system and readily available during decision making process, also security is not a concern.


Plain authentications over the internet

Plain Authentications over the Internet

  • Distributed computing and the Internet have caused a paradigm shift in computing security

  • Security threats

    • Data confidentiality, integrity

    • Re-play attack

    • Non-repudiation

    • Identity theft, privacy, etc.

  • man-in-middle attack

  • Cryptography has a role to play in secure Access Control, especially in distributed environment like Internet.


Role of cryptography

Role of Cryptography

  • Properties provided by cryptography (symmetric/asymmetric),

    • Data confidentiality

    • Data integrity

    • Authentication, Authorization

    • Non-repudiation

    • These properties can be realized in distributed environment using digital certificates

  • PKI comes into picture

    • X.509 (centralized framework), SPKI/SDSI (de-centralized)

  • Only integration of PKI with applications may not suffice!

    • Other Access Control Issues


Access control issues

Access Control Issues

  • How is security to be managed?

    • Do we centralize or decentralize?

    • A security policy should be implemented consistently

  • Single point of control

    • Policy likely to implemented consistently throughout

    • May be performance bottleneck

  • Multiple control points

    • Implementation of policy more likely to be inconsistent

    • Performance likely to be improved

    • Flexible and natural policies


Towards a flexible access control mechanism for e transactions

PKI

  • X.509

    • Centralized architecture

    • Global “root” CA are responsible for proper functionality of setup

    • Sub-ordinate CAs help in management, but delegation is limited

    • Single digital-certificate is used for name and authorization binding

    • Trust accumulates at CA, loss of flexibility

    • Key management is costly and cumbersome for large setup (CRL)


Towards a flexible access control mechanism for e transactions

PKI

  • SPKI/SDSI

    • Decentralized architecture

    • Separate name and authorization certificates (privacy)

    • Each principal can independently issue certificates (local name space)

    • Principals can also make name and authorization bindings on names (defined in local name space or in someone else’s name space) rather than on exact keys (extended names)

    • Global CAs can be accommodated in the setup

    • Principals can delegate acquired authorizations to others (if allowed)

    • The onus of generating proof of some authorization is left on requester rather than on resource controller


Towards a flexible access control mechanism for e transactions

PKI


Modeling security requirements for ac

Modeling Security Requirements for AC

  • For today's complex applications over the Internet, the security requirements cannot be met merely by PKI based frameworks

  • Let us see with the help of few simple scenarios what are the requirements of a generic access control mechanism

  • We shall also see how these requirements can or cannot be met in existing frameworks


Scenario 0

Scenario 0

Underlying security framework: X.509


Scenario 1

Scenario 1

  • Is it possible to delegate authorizations and restrict the number of authorized users?

Underlying security framework: SPKI/SDSI


Scenario 2

Scenario 2

  • Is it possible to restrict the depth of authorization delegation?


Scenario 3

Scenario 3

  • Can each user have different accessing rights on the resource?

    • A typical approach is to categorize users into different roles and authorize them against the rights honored against respective roles.

    • This way resource controller has to maintain less info. in a manageable way (work-flow systems, RBAC etc.)

    • Another approach could be to include all the permissions into user’s certificate itself, but this leads to revelation of information that is not necessary while performing a particular authorization

    • This is suitable for setup where users exercise rights from a well-defined fixed set of rights.


Scenario 4

Scenario 4

  • Is it possible to restrict an authorized user from acting as a service proxy for others?

    • In communications that are not face-to-face, remote lending cannot be prevented, regardless of whether privacy-protecting certificates or fully traceable identity certificates are used. Indeed, the “lender” might as well perform the entire showing protocol execution and simply relay the provided service or goods to the “borrower” [Stefan Brands].

    • Case 1: auction robots – acting on behalf of its owner

    • Case 2: laundry service – if authorization credentials does not tightly bind the recipient of the service, users may run the laundry service

    • Case 3: privacy violation – if authorization credentials bind lot of user information with it

      • Reduces the scope of the underlying certification scheme or

      • Possess privacy threats


Modeling dynamic security requirements

Modeling Dynamic Security Requirements

  • We have argued that the existing frameworks do not support the following features:

    • Constraints & flexibilities required for specifying proxies by users,

    • Variable access rights for the users,

    • Emergency access requirements, and

    • Robustness/fault-tolerance and immediate revocation of authority


Flexi acl

flexi-ACL

  • Every access request is a negotiation between resource controller and the requester

  • We should have a judicious mix of certificates and on-line schemes (authentications), based on the requirement trade-offs

  • Our approach addresses the modeled requirements through the following abstractions

    • Abstract out the core access control across scenarios as a global policy specification that can and will be handled through certificates

    • Specify refinements that may require on-line schemes as local policy

    • The overall policy is then obtained through a merger of global and local policies.


Flexi acl typical controller requester interaction

flexi-ACL [Typical “controller-requester” Interaction]

Challenge: Access Control Rule

Response: Certificate Chain as proof

+


Aintersect function derive actual perms

AIntersect() Function [Derive Actual perms.]


Flexi acl scenario 1

flexi-ACL: Scenario-1

Challenge: Access Control Rule

Response: Certificate Chain as proof

Stop the service to members of

my-group defined in the ACL

Remove this rule from acl

+


Flexi acl scenario 2

flexi-ACL: Scenario-2

Challenge: Access Control Rule

Response: Certificate Chain as proof

Disable write perm on ftp

temporarily

+

Remove write from

the (tag ) field


Flexi acl scenario 3

flexi-ACL: Scenario-3

Challenge: Access Control Rule

Response: Certificate Chain as proof

Introduce a new perm foo on ftp

+

foo

Add foo to the

(tag ) field

*


Flexi acl scenario 4

flexi-ACL: Scenario-4

Challenge: Access Control Rule

Response: Certificate Chain as proof

Restrict access of ftp to the

members of my-group only

+

foo

Remove the (delegate)flag

*


Flexi acl modified tag field of spki sdsi

flexi-ACL [Modified (tag) field of SPKI/SDSI]

  • SPKI/SDSI allows application developers to define the structure of (tag) filed present in ACL rules and authorization certificates

  • Instead of (tag (resource (permissions))) in ACL / authorization certificates,

  • We have adapted following modification:

    • for ACL

      (tag (resource (*)(permissions-dynamic)))

    • for authorization certificates

      (tag (resource (permissions-static)(*)))

  • So that the resultant intersection will produce a combination of overall global policy (prescribed in certs) + local policy (prescribed in ACL)


Flexi acl introduction of positional operator in tag

flexi-ACL [Introduction of positional * operator in (tag)]

Challenge

Response

+


Flexi acl typical structure

flexi-ACL: Typical Structure


Flexi acl rule types supported

flexi-ACL [rule types supported]

  • flexi-ACL allows integration of a priori defined authentication mechanisms (standard/proprietary) as rule types for a given setup

  • For example;

    • spki

    • pamd

    • RSA SecurID

    • biometric

    • TCP/IP wrapper

    • token

    • et. al.


Flexi acl rule type examples

flexi-ACL [rule type examples]

Possession of

credentials

Proof of

evidence

Reputation or

Reference


Flexi acl scenarios

flexi-ACL: Scenarios

  • Stop providing service to non-conforming users

    The Resource Administrator has control over one of the a priori defined authentication mechanisms integrated with flexi-ACL

    Administrator simply revokes the non-conforming user from the authentication mechanism, though the user is satisfying global policy, it is not satisfying the local policy and hence denied access

  • A particular user U should not access the resource more than “n” times

    For such requirements of tracking the state of user’s access to the resource, the administrator may integrate a suitable authentication mechanism into the rules-set.

    For example, one-time-passwords, or a mechanism integrated with database, to keep track of number of accesses already made.


Flexi acl scenarios1

flexi-ACL: Scenarios

  • Provide more permissions to the users who can satisfy additional policy requirements

    Administrator can put the additional policy requirements in conjunctions with the necessary e-authentication mechanisms as a conformance check.

  • Introduce a new permission foo over the resource only to certain users

    Administrator will create a new rule inside the acl-block, in which permission foo is introduced as a new permission under local policy but availed to the users who can authenticate themselves against the newly integrated e-authentication mechanism integrated with the rule using AND operator.


Comprehensive scenario layered security infra

Comprehensive Scenario: [Layered Security Infra.]


Conclusions

Conclusions

  • We have argued the need for a hybrid of digital certificates and other state-based schemes to arrive at flexible distributed access control specification (flexi-ACL)

  • Inclusion of external authentication mechanisms into the underlying PKI framework empowers the resource controller to provide fine-grained access control

  • The ability of resource controller to enforce local access control policies helps the resource owner in granting discretionary auxiliary rights to the users

  • Such an approach is also helpful in achieving properties like; “rights amplification”, “fault-tolerance”, “instant authority revocation”, and better trust management!


Future directions

Future Directions

  • How do we “do” access control if we can’t identify subjects?

    • Mobile code

    • e-Commerce customers

  • How do we control the access of untrusted code running on our machine?

    • Sandboxes

    • Code signing

  • Notion of incomplete contracts

    • Trust is an important ingredient for execution of incomplete contracts


Future directions1

Future Directions


Contact references

Contact & References

Prof. R. K. Shyamasundar

Dean, School of Technology and Comp. Science

[email protected]

http://www.tcs.tifr.res.in/~shyam

Vishwas Patil

Scientific Officer

[email protected]

http://www.tcs.tifr.res.in/~vishwas

We will reply

before lunch-break

Your

Questions

http://www.tcs.tifr.res.in/~vishwas/pub/flexiacl/flexiacl-2.pdf

http://www.tcs.tifr.res.in/~vishwas/pub/tm/tm.pdf


  • Login